Posted
by
CmdrTaco
on Wednesday February 17, 2010 @10:30AM
from the imagine-if-pdf-was-an-open-format dept.

CWmike writes "Just hours before Adobe is slated to deliver the latest patches for its popular PDF viewer, ScanSafe announced that by its counting, malicious Adobe Reader documents made up 80% of all exploits at the end of 2009. In the first quarter of 2009, malicious PDF files made up 56% of all exploits tracked by ScanSafe. That figure climbed above 60% in the second quarter, over 70% in the third and finished at 80% in the fourth quarter. Mary Landesman, a ScanSafe senior security researcher, said, 'Attackers are choosing PDFs for a reason. It's not random. They're establishing a preference for Reader exploits.' Exactly why hackers choose Adobe as their prime target is tougher to divine, however. 'Perhaps they are more successful,' she said. 'Or maybe it's because criminal attackers are human, too. We respond when we see a lot of people going after a particular product... We all want to go after that product, too. In the attacker arena, they might be thinking, 'Gee, all these reports of Adobe Reader zero-days, maybe I should get in on them too.'"

Err, hence I said "That and disabling browser integration" in response to the OP's question.

There's no risk in disabling it. If you download a form that requires it Reader will prompt you and ask if you want to enable JavaScript for that particular PDF. If it's from a trusted source, go ahead and allow it. I've seen plenty of PDFs prompt for Javascript access and when denied seem to have no negative impact. Forms are about the only type I've seen that are impacted.

Never, ever install the PDF plug-in, for any browser. They are slow as hell and open up security issues.
Always open PDF files with a stand alone program and for added security make sure it ain't Adobe.

The official PDF spec includes scripting and DRM and all kinds of other crap that 99.99% of pdfs don't use. Many 3rd party readers limit themselves to just displaying documents, so the third party readers are have a much smaller surface area of attack.

The plain and simple fact is that it is hard to make secure software. Couple that with the fact that the PDF format is well over 20 years old (as you can imagine there's a lot of legacy code in the viewer) and you have a recipe for the perfect security nightmare.

The reason for the PDF preference is not "me too". It is, simply, the best current trojan delivery vehicle. I send my CV in PDF format, most of the documents that I deal with are in PDF format.

And I have no way of telling if opening a particular PDF in a particular reader will cause an exploit.

Most users/blockers will not allow EXEs, and can open "ZIP" files to determine if an EXE is enclosed. Microsoft Word has been "hardened". The exploits are going for the weakest part -- output that is in a universal format and is commonly shared. That just happens to have one reader that has most of the market share.

Which means that I will continue to use "Evince" and hope that it won't be targeted soon.

Adobe reader's web plugin simply opens PDFs without any warning. Nor does it warn if there is javascript running on the PDF. Its a cracker's dream. Most other applications give some kind of warning, especially if there's something scripted in the document. Adobe does none of this. Heck, you can disable Javascript but it will helpfully remind you that its disabled and offer to unblock it if you attempt to open a pdf with javascript. Its really an incredibly terrible way to handle security.

This thing should at least be shipping with js disabled and the only way to enable it is by going into Preferences. The web plugin should be retired and just force the pdf to open in the full reader. One can dream, right?

Worse yet, instead of warning you that a PDF is about to execute JavaScript code, Adobe Reader actively and repeatedly harasses you if you turn off JavaScript, telling you that it won't work properly. This, even if the PDF you are viewing contains no JavaScript whatsoever.

Instead of bothering you when you do something dangerous, it bothers and encourages you to let it behave insecurely. Adobe has become the new Microsoft, with respect to hindering user security.

Worse yet, instead of warning you that a PDF is about to execute JavaScript code, Adobe Reader actively and repeatedly harasses you if you turn off JavaScript, telling you that it won't work properly. This, even if the PDF you are viewing contains no JavaScript whatsoever.

Hrm tested this in 9 - it only complains with Javascript disabled that the PDF contains some elements that might not be displayed properly because of the preference, and ONLY IF you open a PDF with Javascript in it.

But EVERY document I've seen HAS javascript. I don't know what that javascript is, but I assume it's stuck in there automatically by Adobe Acrobat (not reader) or something because it's ALWAYS there. (Some 3rd party PDF creators might not put it in. I haven't tested.)

Interestingly enough - in my days at Adobe doing Tier 3 support - the exploit PDF's I'd get from various sources internally were hard to move around the network because virus scanners would delete or clean them up.

I found this rather surprising many times because these scanners would do this to files that were zero day exploits and files that weren't yet disclosed to the public.

Also if your installing reader to your enterprise you can disable browser integration, javascript and a myriad of other features ou

As you mentioned, disabling JavaScript helps. But you can also prevent PDFs from opening automatically with the plug-in, and also prevent them from opening automatically with the stand-alone reader. There are some other mitigations there as well.

Of course, this all requires manual configuration. There is no hope for the average home user.

Most users/blockers will not allow EXEs, and can open "ZIP" files to determine if an EXE is enclosed.

And IMO this is exactly why everyone should be wary of putting scripting languages into documents. We have a well-established convention of distinguishing "documents" from "applications"; "documents" are passive collections of information, whereas "applications" do stuff.

We block applications and scripts because they do stuff and we can't easily know what it is that they do, but we don't block documents because, in theory, they can't do anything. Loading a document in its proper viewer application shouldn't do anything that the viewer wasn't explicitly designed to do. If you throw scripting applications and macros into the documents, then suddenly the "documents" do stuff too. This, in my opinion, is bad.

If you write a script for Word to do something that would normally take a thousand mouse clicks to do - why is that bad?

It's not bad to run a useful and benign macro that you wrote youself.
What's bad is that in a botnet's hands VBA has access to the entire computer, and not just to the document or its' folder. (yes, I know that there have been some improvements in that regard, but that depends more on the OS & application settings than on inherent VBA limitations)

Just to be clear: I have no problem with macros. I have no problem with scripts. If you want to write a macro in Word that will make your workflow easier and faster, I think that's great. I think it's great that Microsoft had the forethought to include support for scripting in MS Office.

What I object to is embedding macros in Word documents. I think this is dangerous design. If you want to write your own macro and store it on your computer, then you shouldn't need to embed it in the document itself.

Believing any document format to be "inert" is a fallacy. All data must be somehow interpreted by the computer in order to be useful -- a pile of bits on a hard drive is not useful to any human. Whether there are exploitable flaws in the software which interprets the data is only loosely related to the data itself. There have been exploitable bugs in everything from PDF readers to MIME decoders to MP3 players. Obviously, deliberately embedding a scripting language into a document format does not help matter

...but don't confuse yourself into believing that some document formats are inherently safer than others. The vulnerability is fundamentally in the software, not the document.

I'm not the one confusing things. First, of course it's not the format itself, but what's interpreting the file. Text files are pretty harmless all by themselves, but I don't go sending arbitrary text files to be interpreted by bash. Likewise, it's not the inclusion of javascript in PDFs that's a problem, but rather the fact that PDF viewers interpret that javascript creates a great opportunity for malicious code.

And yes, theoretically, if a viewer has exploitable flaws, then you can exploit them. I'm

All data must be somehow interpreted by the computer in order to be useful

It's not a question of code being run, it's a question of attack surface. A properly-designed document format that does few things can be interpreted by simpler code, and thus is less likely to be exploitable for attacks. PDFs should be proof of this rule by now, given how much of a monstrosity both the spec and Adobe reader are at this point. See also javascript vulnerabilities in browsers.

And IMO this is exactly why everyone should be wary of putting scripting languages into documents. We have a well-established convention of distinguishing "documents" from "applications"; "documents" are passive collections of information, whereas "applications" do stuff.

You are making the "keep the code separate from the data!" argument. You forget the one place in every application where code and data intermingle: the stack.

There is no getting around the stack. It is itself data about what code to exec

Attacking Adobe Reader means that people who use Firefox are also at risk. For a long while, the popular security paradigm on Windows was that if you used IE you were at risk, but if you kept up with Windows Update and used only Firefox to browse the web you were pretty much safe from the majority of the exploits in the wild. Now that malicious PDFs are out there in force, users of Firefox are vulnerable once again.

Probably because, based on UI, speed, size, sheer awkwardness and oddball behavior (does it still act like you're doing a reinstall when you change a config option?), Acrobat consists mostly of unmaintainable spaghetti code - leaving it full of potential exploits.

So, as I understand it, this article (and the referenced report) refer to code, not the total number of infections/attacks. It would be useful to know (1) how many computers are affected by PDF attacks, and (2) how many PDFs out there are compromised.

Well for one the VP of Technology in our Company.
But I think it is more a personality issue with him. Basically you can tell him he shouldn't do something for any number of reasons. He will spend days trying to figure out why he has to do something exactly the way you asked him not to it.I just cringed when someone told him he couldn't use Adobe Reader on his MacBook. Sure enough a week later it was installed.

It's also interesting because it tells you if your browsers are insecure (due to plugins or the browser itself). Both IE8 and Chrome are insecure in current versions with all patches.

It was pretty eye opening for me, because I thought that I kept secure, but I had 20 insecure applications when I first got the scanner. I'm always skeptical about getting stuff for free, but I imagine that Secunia uses the data to improve the accuracy of their business software.

To return to the story topic... when possible, use Adobe alternatives (e.x. Sumatra instead of Adobe Reader) and check your flash player and shockwave player versions at least once a week.

One more thing in my diatribe...recent versions of the Shockwave Player don't update correctly. I installed the latest version to fix a couple critical vulnerabilities only to find out that it wouldn't reomve the vulnerable files from my system directory. I had to download the Shockwave uninstaller, reboot my PC, reinstall shockwave, and reboot again. I felt like I was back on Windows 9x again.

I opened the Advanced interface of Secunia PSI, the program overview says:'Cannot display graph, as Adobe Flash Player does not appear to be installed in Internet Explorer on your computer...' then provides a link to install it.

I wasn't even aware that the PSI used the Trident rendering engine. I thought for sure they'd use Gecko or WebKit.
The more you know, I suppose.
The tool works very well though- it warns me about having insecure versions of GTK, for instance.

That irritated the hell out me too! Especially since flash is a pain in the ass to update. You may install a new one, but old cruft is left behind that can be difficult to remove sometimes. Other than the flash issue, Secunia PSI is excellent.

In the attacker arena, they might be thinking, 'Gee, all these reports of Adobe Reader zero-days, maybe I should get in on them too.

It isn't that. It is the fact that some of the holes took so long to have patches released, so people who don't read techie news (so didn't know to turn Javascript off in the case of those holes in that area) we vulnerable for some time even once the flaw was "publicly" known. This gave crackers time to throw together a "me too!" exploit for the same bug, and encouraged them to keep looking at the platform (if a hole, once found, stays open for some time then the effort is more worth it than looking for a hole on a platform where security patches are released in a more timely fashion).

The other advantage of attacking Adobe's PDF reader is, as with Flash and other cross-browser plug-ins, one of target audience size. A successful attack may affect users of multiple browsers rather than, for example, just those who run a particular version of IE.

I just got a trojan yesterday through a PDF, while using Foxit and running Windows 7 x64 in Firefox. I didn't think anything of allowing a website to execute a PDF file (I was not aware at the time that you could execute code through a PDF).

The trojan downloaded quite a bit of malware onto my system that I spent last night cleaning from the registry. This is the first time I've gotten malware on my computer in years.

Sadly, yes [coresecurity.com].
Foxit isn't happy with just doing basic rendering on PDF's, but wants to be a more completely alternative to Adobe's Reader. This includes things like running PDF's scripting, and makes it harder to implement securely.

I'm not saying a secure, full-featured PDF reader can't be made, so much as that you're a lot safer using a program that only does the basic rendering. Foxit doesn't fit the bill. It's also closed source >.>

I have noticed that while web browsing and even when using the currently latest Mozilla Firefox 3.5.7 or 3.6 with Ad-Block Plus and PDF Download add-ons installed I still would get hit with a web page that would automatically push a Adobe Reader PDF file to me and I would have it open automatically. That PDF would be just a page full of random words but when inspected in Adobe Acrobat in depth when you go into the Advanced \ Document Processing \ Edit All JavaScript... menu you immediately see a script inside the PDF that is launched upon opening that PDF. When I analyzed the script I saw calls strange calls to the execution functions and methods along with calls to write out encoded data from an array holding hexadecimal values to files.

With the known exploits in Adobe Reader 9.0 versions and earlier it was easy for me to see why this product was used as a popular attack vector in the last few months for viruses to spread on the Internet.

Luckily, I use my computer as an ordinary user and use Run As with User Account Control requesting a password for any administrative work and program installation I avoided being infected with these Trojan horse PDFs.

Some of you might recommend using the Mozilla No Script add-in to block all scripts but the reality is that there is so much JavaScript code out there on the web that turning scripting off makes many web sites unusable since they've all be designed with this reliance on scripting for navigation.

Uncheck "Preferences->Internet->Display in browser" and Acrobat will prompt you to save those files rather than automatically loading them (this will probably also render your downloading extension redundant).

Some of you might recommend using the Mozilla No Script add-in to block all scripts but the reality is that there is so much JavaScript code out there on the web that turning scripting off makes many web sites unusable since they've all be designed with this reliance on scripting for navigation.

If I wanted to disable Javascript entirely, I'd do it in the browser preferences or options or whatever that is. The advantage of NoScript is that it does it selectively. Most sites I go to I've just activated pe

As another poster pointed out: including scripting capabilities in "static" documents is just dumb. We've already been through this a few years ago, with people sending around Microsoft Office documents.

Microsoft "fixed" this, in the sense that Office now warns you if a document contains scripting. Better, of course, is that many people have learned not to send or accept such documents in the first place. This was part of what made PDFs popular: a format to send documents that (a) cannot easily be changed and (b) is not a security risk. Millions of business documents are sent as PDFs just for these reasons.

How stupid must Adobe be, to open themselves to this kind of attack. There should be no scripting in PDF documents. Alternatively - second best - scriptiing should be disabled by default, unless the user specifically authorizes it (as with Microsoft Office documents).

They target Adobe's PDF reader because it is extremely widespread, most users don't even realise PDF is a standard and that other readers exist... They think it's a proprietary format only supported by a single program.As a consequence, virtually every potential victim will be running exactly the same code, or a small subset of possible versions making them a very easy target.Also Adobe's software hasn't been attacked much before, and therefore is likely to have many more undiscovered bugs.

we can no longer wait while this threat emerges, it is time for us all to purchase ScanSafe(c) and renew contracts regularly and indefinitely to their fullest. may there be no further discussion of alternative readers, operating systems, or patches and repairs that could be made. This report clearly outlines the repercussions of using the PDF format in that it is an unholy vessel by which godless demons infest your small business and personal computer to rape the data within. Only through the glory of Sc

Adobe Reader and Adobe Flash have as close to a 100% share of the desktop as makes no difference. The geek's dislike of these programs has had no more effect on their use than the phases of the moon or the rising and setting of the sun.

How about "Adobe Reader is the only relevant PDF reader on the market"? Is it really that hard to understand?

Or how about:

"Adobe Reader is shit. Zero day exploits are like shooting ducks in a barrel." Or maybe "It's the platform, and Adobe is just the vector de jour. IE was last months, Office the month before that, and Flash (or something equally widespread, complex, superfulous and buggh) is next month's..."

Microsoft Windows users are known as the road-kill of the Information Superhighway for a reason, and Adobe can only take some small credit for their contribution to that.

Drive-by installs via exploit vulnerability can happen on any OS. Only thing that might currently mitigate that is SELinux, but it's pain in the ass generally and no casual user would put up with it. Most of the vulnerabilities now a day are in 3rd party softwares like Flash or PDF Reader. They are exactly as vulnerable on any system.

It pretty much all happens on Windows currently only because its so popular (and the users are generally dumber than those geeks running

Whoa, you're bringing up ten year old worms to the table. Do you even understand how many old worms there has been with Linux/UNIX in all of its history, most of them not even requiring a web server?

Any of those things you list as "poor security choices from Microsoft" aren't even such.

patch Tuesday

Patch Tuesday streamlines the update process in large companies. It would be really bad solution from MS to force the update randomly, possibly breaking things. Linux doesn't even have automated update at all - you have to ru

Patch Tuesday streamlines the update process in large companies. It would be really bad solution from MS to force the update randomly, possibly breaking things.

You seem to confuse "offer" with "force". Why not offer a patch when it is ready and let the companies decide themselves when and how often to patch? Just like every other OS vendor on the face of the planet?

Linux doesn't even have automated update at all - you have to run your update tool when its convenient for you, or go and compile the new kern

This was certainly an MS issue, the fact that the number of apache INSTALLATIONS is considerably smaller. The default IIS install having crappy permissions didn't help. The fact that most of the infections where on client PCs and servers that never should have had IIS installed plays a part in it. The fact that admins run Apache and are far more likely to keep it up to date than gradma who never installs updates.

Leaving aside your ridiculous invocation of a ten year old worm for IIS, you do realize since the release of IIS6 in 2003, IIS6 and IIS7 have had FAR FEWER vulnerabilities discovered than any version of Apache, right?

The rest of your rant is evidence you don't seem to have a very good grasp of how Windows works.

Bla bla bla victim of popularity. Yes you can expect your popular product to be attacked more because of its popularity. But that doesn't excuse the vendor of fixing it. The same popularity should (if your business model isn't full of fail) enable you to audit your code and respond to vulnerabilities faster. The number of attacks are up but so is your research and development funding.

The problem is that even though a vendor knows the attacks are coming and often has the resources to head it off, very o

No, it's because very few linux users are computer illiterate, while a great many windows users are. Targeting windows users (and with attacks like this, it is the users that make the attack possible, not the platform) is going for the low hanging fruit.

Bingo! Give that man a ceeegar! As a PC repairman I have managed to cut down my users infection rates by a good 80-85% by changing their habits. Autoupdates enabled, Firefox instead of IE, ABP installed, updated Comodo AV/Firewall installed, but I can't get it any lower than that. Why? PEBKAC, that's why.

I have actually sat beside a user and said "Don't open that. It is a password protected.zip file sent by email. It is a virus" and had the user go "Ohhhh you worry too much! This is from my BBF Kim! She w

What no one, especially Adobe, talks about is the possibility that some of these crackers are former programmers for Adobe with access to source code. I'm sure the fact that Adobe rarely fixes holes in its software, preferring to make customers upgrade instead, makes them an even more tempting target. Probably 3/4 of our customers are running Acrobat Reader 7 or earlier because no one wants to go to the trouble of upgrading reader software, and Adobe's filthy habit of forcing customers to install garbage t

'Probably 3/4 of our customers are running Acrobat Reader 7 or earlier because no one wants to go to the trouble of upgrading reader software, and Adobe's filthy habit of forcing customers to install garbage that they vehemently don't want (like their stinking download manager) doesn't help matters.'

The thing I especially love about this is how Adobe have now stopped providing security updates for Acrobat 7 (the full version you pay money for, not just the reader). Acrobat 7 was a current product until just

The difference is that windows is the only platform which doesn't come with a PDF reader by default...

And to make matters worse, many users aren't aware that alternative pdf readers exist at all, how many mac users do you think install adobe's viewer because they don't realise preview.app can handle PDF files very well. Users have the mindset that file formats are proprietary and belong to specific programs.

Users have the mindset that file formats are proprietary and belong to specific programs.

How about:

Users have the mindset that their documents are somehow stored "inside" the program. Consider a conversation I had recently about a customer that needed a newer office suite, but didn't like the Office 2K7 ribbon:

Me: Ok...so we'll uninstall Office 97, and install OpenOffice instead. It's free.Them: But all my documents are in Word.Me: Yes. OpenOffice will handle them just fine.Them: But all my documents are stored in Word. If you take Word off my computer, how will I get my documents?Me: Just

A disturbing number of mac users actually install adobe reader and let it set itself as their default pdf viewer, despite that OSX already comes with a much better PDF viewer, people are conditioned to think that PDF files require adobe acrobat.

I agree with this analysis of Javascript. It was never designed with security in mind, much like the original versions of Windows.

That said, it's sort of silly anyway. How do these PDFs arrive? By email or downloaded from the internet. And what do we NOT do with email attachments we don't recognise? We DON'T open them. What do we do with something we downloaded from the internet? Scan it for viruses.

We all know the defense. It's getting people to use their brains instead of happily clicking on everyt

And what do we NOT do with email attachments we don't recognise? We DON'T open them. What do we do with something we downloaded from the internet? Scan it for viruses.

It's possible that.PDF exploits are so successful because the average user doesn't think of them as an executable file. Under windows, the idea of "don't open.exe attachments!" has been drummed into the heads of all but the noobest of noobs (grandparents, AOL'ers etc.), but how many "experts" pass every web URL to a virus scanner before brow

I had problems viewing documents with complex formatting and embedded Chinese fonts on Foxit. Returned to Adobe. It is easy to miss some information in the document without even realizing it, if the reader sacrifices functionality in favor of being lightweight. I would any day prefer fidelity to the PDF spec over being lightweight.

Primitive how. I use it all the time. I put it on all the computers in the company. It is small, fast and secure. I have never had a problem opening, reading or printing a PDF file. When doing those things it is in fact superior to Adobe reader everytime.

You cannot use Foxit on Livecycle forms and other kinds of interactive forms. Foxit doesn't support online commenting and reviewing, Foxit doesn't support 3d annotations (Reader even supports PMI extensions). Yeah Reader is big, but it has a ton of customer requirements.

Foxit does have security advisories - google it, and its not even a major target.

The requirements are shit. If you want to edit do not use PDF. PDF should be scaled back to what it was needed for. All these "requirements" are really just trying to use the wrong format to do what you want. When you try to make one format do everything in the world it WILL be buggy. It WILL be slow. It WILL be insecure. Its not like the users here never want a PDF to do something else for them. I just refuse to allow it into my environment.

I'm wondering the same thing myself. I use Sumatra instead which is a far more stripped down reader. My instincts tell me that I'm safer because it doesn't have all of the integration (java etc) but I'd love to see some comparisons.

Well if you just want to READ pdf files (not print them) then i would suggest just loading them in Google Docs.
You don't need any plugins for that (no Flash etc) as each page is simply converted to an image server side. I would think that this is secure.

In any case i always disable all file format plugins in FireFox. It actually happened a few days ago that i was suddenly asked to save a PDF file even though i didn't click on any link, on examining adblock i found a hidden iframe that apparently tried to